Defintely making progress now.
I looked at the implentation and lo and behold, I do indeed return a char* that is created locally. That should have occured to me when I couldn't find a good place for a 'delete'.
Still having crashing but I'm sure it's other similar stuff. Unintialized variables, missed pointers, local variables that lose scope, etc.
